MS16-101: Description of the security update for Windows authentication methods: August 9, 2016

2017-05-12T07:55:53
ID KB3167679
Type mskb
Reporter Microsoft
Modified 2017-05-12T07:59:26

Description

<html><body><p>Resolves vulnerabilities in Windows that could allow elevation of privilege if an attacker runs a specially crafted application on a domain-joined system.</p><h2></h2><div class="kb-notice-section section"><span><span class="text-base">Important</span> This article contains information that shows you how to help lower security settings or how to turn off security features on a computer. You can make these changes to work around a specific problem. Before you make these changes, we recommend that you evaluate the risks that are associated with implementing this workaround in your particular environment. If you implement this workaround, take any appropriate additional steps to help protect the computer.</span></div><h2>Summary</h2><div class="kb-summary-section section">This security update resolves multiple vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker runs a specially crafted application on a domain-joined system. <br/><br/>To learn more about the vulnerability, see <a href="https://technet.microsoft.com/library/security/ms16-101" id="kb-link-2" target="_self">Microsoft Security Bulletin MS16-101</a>.<br/></div><h2>More Information</h2><div class="kb-moreinformation-section section"><span class="text-base">Important </span><ul class="sbody-free_list"><li>All future security and non-security updates for Windows 8.1, and Windows Server 2012 R2 require update <a href="https://support.microsoft.com/en-us/help/2919355" id="kb-link-3" target="_self">2919355</a> to be installed. We recommend that you install update <a href="https://support.microsoft.com/en-us/help/2919355" id="kb-link-4" target="_self">2919355</a> on your Windows 8.1-based or Windows Server 2012 R2-based computer so that you receive future updates. </li><li>If you install a language pack after you install this update, you must reinstall this update. Therefore, we recommend that you install any language packs that you need before you install this update. For more information, see <a href="https://technet.microsoft.com/en-us/library/hh825699" id="kb-link-5" target="_self">Add language packs to Windows</a>.</li></ul><div class="faq-section" faq-section=""><div class="faq-panel"><div class="faq-panel-heading" faq-panel-heading=""><span class="link-expand-image"><span class="faq-chevron win-icon win-icon-ChevronUpSmall"></span></span><span class="bold btn-link link-expand-text"><span class="bold btn-link">Non-security-related fixes that are included in this security update</span></span></div><div class="faq-panel-body" faq-panel-body=""><span><div class="kb-collapsible kb-collapsible-collapsed">This security update also fixes the following non-security-related issues:<br/><ul class="sbody-free_list"><li>In a Domain-joined Scale Out File Server (SoFS) on a domainless cluster, when an SMB client that is running either Windows 8.1 or Windows Server 2012 R2 connects to a node that is down, authentication fails. When this occurs, you may receive an error message that resembles the following message:<br/><br/><div class="sbody-error">STATUS_NO_TGT_REPLY<br/></div></li></ul></div><br/></span></div></div></div><h3 class="sbody-h3">Known issues in this security update</h3><ul class="sbody-free_list"><li><span class="text-base">Known issue 1</span><br/><br/>The security updates that are provided in <a href="https://support.microsoft.com/help/3178465" id="kb-link-6" target="_self">MS16-101</a> and newer updates disable the ability of the Negotiate process to fall back to NTLM when Kerberos authentication fails for password change operations with the <span class="text-base">STATUS_NO_LOGON_SERVERS (0xc000005e)</span> error code. In this situation, you may receive one of the following error codes. <br/><br/><div class="table-responsive"><table class="sbody-table table"><tr class="sbody-tr"><th class="sbody-th"><span class="text-base">Hexadecimal</span></th><th class="sbody-th"><span class="text-base">Decimal</span></th><th class="sbody-th"><span class="text-base">Symbolic</span></th><th class="sbody-th"><span class="text-base">Friendly</span></th></tr><tr class="sbody-tr"><td class="sbody-td">0xc0000388</td><td class="sbody-td">1073740920</td><td class="sbody-td">STATUS_DOWNGRADE_DETECTED</td><td class="sbody-td">The system detected a possible attempt to compromise security. Please make sure that you can contact the server that authenticated you. </td></tr><tr class="sbody-tr"><td class="sbody-td">0x4f1</td><td class="sbody-td">1265</td><td class="sbody-td">ERROR_DOWNGRADE_DETECTED</td><td class="sbody-td">The system detected a possible attempt to compromise security. Please make sure that you can contact the server that authenticated you. </td></tr></table></div><br/><br/><span class="text-base">Workaround</span><br/><br/>If password changes that previously succeeded fail after the installation of MS16-101, it's likely that password changes were previously relying on NTLM fallback because Kerberos was failing. In order to change passwords successfully by using Kerberos protocols, follow these steps:<br/><br/><br/><ol class="sbody-num_list"><li>Configure open communication on TCP port 464 between clients that have MS16-101 installed and the domain controller that is servicing password resets. <br/><br/>Read-only domain controllers (RODCs) can service self-service password resets if the user is allowed by the RODCs password replication policy. Users who are not allowed by the RODC password policy require network connectivity to a read/write domain controller (RWDC) in the user account domain. <br/><br/><span class="text-base">Note</span> To check whether TCP port 464 is open, follow these steps:<br/><br/><br/><ol class="sbody-alpha_list"><li>Create an equivalent display filter for your network monitor parser. For example:<br/><div class="sbody-code"><pre><code><div class="indent">ipv4.address== <ip address of client> && tcp.port==464</div></code></pre></div></li><li>In the results, look for the "TCP:[SynReTransmit" frame. <br/><br/><img alt="Frame " class="graphic" src="/Library/Images/3190143.jpg" title="Frame "/></li></ol></li><li>Make sure that the target Kerberos names are valid. (IP addresses are not valid for the Kerberos protocol. Kerberos supports short names and fully qualified domain names.) </li><li>Make sure that service principal names (SPNs) are registered correctly. <br/><br/>For more information, see <a href="https://technet.microsoft.com/en-us/library/jj134304(v=ws.10).aspx" id="kb-link-7" target="_self">Kerberos and Self-Service Password Reset</a>. </li></ol></li><li><span class="text-base">Known issue 2</span><br/><br/>We know about an issue in which programmatic password resets of domain user accounts fail and return the <span class="text-base">STATUS_DOWNGRADE_DETECTED (0x800704F1)</span> error code if the expected failure is one of the following:<br/><br/><ul class="sbody-free_list"><li>ERROR_INVALID_PASSWORD </li><li>ERROR_PWD_TOO_SHORT (rarely returned) </li><li>STATUS_WRONG_PASSWORD </li><li>STATUS_PASSWORD_RESTRICTION</li></ul><br/>The following table shows the full error mapping. <br/><br/><div class="table-responsive"><table class="sbody-table table"><tr class="sbody-tr"><th class="sbody-th"><span class="text-base">Hexadecimal</span></th><th class="sbody-th"><span class="text-base">Decimal</span></th><th class="sbody-th"><span class="text-base">Symbolic</span></th><th class="sbody-th"><span class="text-base">Friendly</span></th></tr><tr class="sbody-tr"><td class="sbody-td">0x56</td><td class="sbody-td">86</td><td class="sbody-td">ERROR_INVALID_PASSWORD</td><td class="sbody-td">The specified network password is not correct. </td></tr><tr class="sbody-tr"><td class="sbody-td">0x267</td><td class="sbody-td">615</td><td class="sbody-td">ERROR_PWD_TOO_SHORT</td><td class="sbody-td">The password that was provided is too short to meet the policy of your user account. Please provide a longer password. </td></tr><tr class="sbody-tr"><td class="sbody-td">0xc000006a</td><td class="sbody-td">-1073741718</td><td class="sbody-td">STATUS_WRONG_PASSWORD</td><td class="sbody-td">When you try to update a password, this return status indicates that the value that was provided as the current password is incorrect. </td></tr><tr class="sbody-tr"><td class="sbody-td">0xc000006c</td><td class="sbody-td">-1073741716</td><td class="sbody-td">STATUS_PASSWORD_RESTRICTION</td><td class="sbody-td">When you try to update a password, this return status indicates that some password update rule was violated. For example, the password may not meet the length criteria. </td></tr><tr class="sbody-tr"><td class="sbody-td">0x800704F1</td><td class="sbody-td">1265</td><td class="sbody-td">STATUS_DOWNGRADE_DETECTED</td><td class="sbody-td">The system cannot contact a domain controller to service the authentication request. Please try again later. </td></tr><tr class="sbody-tr"><td class="sbody-td">0xc0000388</td><td class="sbody-td">-1073740920</td><td class="sbody-td">STATUS_DOWNGRADE_DETECTED</td><td class="sbody-td">The system cannot contact a domain controller to service the authentication request. Please try again later. </td></tr></table></div><br/><br/><span class="text-base"> Resolution</span><br/><br/><a href="https://technet.microsoft.com/library/security/ms16-101.aspx" id="kb-link-8" target="_self">MS16-101</a> has been re-released to address this issue. Install the latest version of the updates for this bulletin to resolve this issue. <br/><br/><a class="bookmark" id="scenario"></a></li><li><span class="text-base">Known issue 3</span><br/><br/>We know about an issue in which programmatic resets of local user account password changes may fail and return the <span class="text-base">STATUS_DOWNGRADE_DETECTED (0x800704F1)</span> error code. <br/><br/>The following table shows the full error mapping. <br/><br/><div class="table-responsive"><table class="sbody-table table"><tr class="sbody-tr"><th class="sbody-th">Hexadecimal</th><th class="sbody-th">Decimal</th><th class="sbody-th">Symbolic</th><th class="sbody-th">Friendly</th></tr><tr class="sbody-tr"><td class="sbody-td">0x4f1</td><td class="sbody-td">1265</td><td class="sbody-td">ERROR_DOWNGRADE_DETECTED</td><td class="sbody-td">The system cannot contact a domain controller to service the authentication request. Please try again later. </td></tr></table></div><br/><br/><span class="text-base"> Resolution</span><br/><br/><a href="https://technet.microsoft.com/library/security/ms16-101.aspx" id="kb-link-9" target="_self">MS16-101</a> has been re-released to address this issue. Install the latest version of the updates for this bulletin to resolve this issue. <br/><br/></li><li><span class="text-base">Known issue 4</span><br/><br/>Passwords for disabled and locked-out user accounts cannot be changed using the negotiate package.<br/><br/> <br/>Password changes for disabled and locked-out accounts will still work when using other methods such as when using an LDAP modify operation directly. For example, the PowerShell cmdlet <span class="text-base">Set-ADAccountPassword</span> uses an "LDAP Modify" operation to change the password and remains unaffected. <br/><br/><span class="text-base">Workaround</span><br/><br/>These accounts require an administrator to make password resets. This behavior is by design after you install MS16-101 and later fixes. <br/><br/></li><li><span class="text-base">Known issue 5</span><br/><br/>Applications that use the <span class="text-base">NetUserChangePassword</span> API and that pass a servername in the <strong class="sbody-strong">domainname</strong> parameter will no longer work after MS16-101 and later updates are installed. <br/><br/>Microsoft documentation states that providing a remote server name in the <strong class="sbody-strong">domainname</strong> parameter of the <span class="text-base">NetUserChangePassword</span> function is supported. For example, the <a href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa370650(v=vs.85).aspx" id="kb-link-10" target="_self">NetUserChangePassword function</a> MSDN topic states the following:<br/><br/><strong class="sbody-strong">domainname [in]</strong><br/><div class="indent">A pointer to a constant string that specifies the DNS or NetBIOS name of a remote server or domain on which the function is to execute. If this parameter is NULL, the logon domain of the caller is used. </div>However, this guidance has been superseded by MS16-101, unless the password reset is for a local account on the local computer. Post MS16-101, in order for domain user password changes to work, you must pass a valid DNS Domain Name to the NetUserChangePassword API. </li><li><span class="text-base">Known issue 6</span><br/><br/>After you install this update, you may encounter 0xC0000022 NTLM authentication errors. To resolve this issue, see <a href=" https://support.microsoft.com/help/3195799" id="kb-link-11" target="_self">NTLM authentication fails with 0xC0000022 error for Windows Server 2012, Windows 8.1, and Windows Server 2012 R2 after update is applied</a>. </li><li><span class="text-base">Known issue 7</span><br/><br/>After you install the security updates that are described in <a href="https://technet.microsoft.com/library/security/ms16-101.aspx" id="kb-link-12" target="_self">MS16-101</a>, remote, programmatic changes of a local user account password, and password changes across untrusted forest fail.<br/><br/><br/>This operation fails because the operation relies on NTLM fall-back which is no longer supported for nonlocal accounts after MS16-101 is installed.<br/><br/><br/>A registry entry is provided that you can use to disable this change. <br/><br/><span><span class="text-base">Warning</span> This workaround may make a computer or a network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk. </span><br/><br/><span><span class="text-base">Important</span>This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base: <div class="indent"><a href="https://support.microsoft.com/en-us/help/322756" id="kb-link-13">322756 </a>How to back up and restore the registry in Windows </div></span><br/><br/>To disable this change, set the <span class="text-base">NegoAllowNtlmPwdChangeFallback</span> DWORD entry to use a value of 1 (one).<br/><br/><br/><span class="text-base">Important</span> Setting the <span class="text-base">NegoAllowNtlmPwdChangeFallback</span> registry entry to a value of 1 will disable this security fix:<br/><div class="table-responsive"><table class="sbody-table table"><tr class="sbody-tr"><th class="sbody-th">Registry value</th><th class="sbody-th">Description</th></tr><tr class="sbody-tr"><td class="sbody-td">0</td><td class="sbody-td"> Default value. Fallback is prevented. </td></tr><tr class="sbody-tr"><td class="sbody-td">1</td><td class="sbody-td">Fallback is always allowed. The security fix is turned off. Customers that are having issues with remote local accounts or untrusted forest scenarios can set the registry to this value. </td></tr></table></div>To add these registry values, follow these steps:<br/><ol class="sbody-num_list"><li>Click <strong class="uiterm">Start</strong>, click <strong class="uiterm">Run</strong>, type <span class="sbody-userinput">regedit</span> in the <strong class="uiterm">Open</strong> box, and then click <strong class="uiterm">OK</strong>. </li><li>Locate and then click the following subkey in the registry:<br/><div class="indent"><strong class="sbody-strong">HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa<br/></strong></div></li><li>On the <strong class="uiterm">Edit</strong> menu, point to <strong class="uiterm">New</strong>, and then click <strong class="uiterm">DWORD Value</strong>. </li><li>Type <span class="sbody-userinput">NegoAllowNtlmPwdChangeFallback</span> for the name of the DWORD, and then press ENTER. </li><li>Right-click <strong class="uiterm">NegoAllowNtlmPwdChangeFallback</strong>, and then click <strong class="uiterm">Modify</strong>. </li><li>In the <strong class="uiterm">Value data</strong> box, type <span class="sbody-userinput"> 1</span> to disable this change, and then click <strong class="uiterm">OK</strong>.<br/><br/><br/><span class="text-base">Note</span> To restore the default value, type 0 (zero), and then click <strong class="uiterm">OK</strong>. </li></ol><span class="text-base"> Status</span><br/><br/>The root cause of this issue is understood. This article will be updated with additional details as they become available.</li></ul></div><h2>How to obtain and install the update</h2><div class="kb-resolution-section section"><h3 class="sbody-h3">Method 1: Windows Update</h3><div class="kb-collapsible kb-collapsible-expanded">This update is available through Windows Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to turn on automatic updating, see<br/><a href="https://www.microsoft.com/en-us/safety/pc-security/updates.aspx" id="kb-link-15" target="_self">Get security updates automatically</a>.</div><h3 class="sbody-h3">Method 2: Microsoft Update Catalog</h3><div class="kb-collapsible kb-collapsible-expanded">To get the stand-alone package for this update, go to the <a href=" http://catalog.update.microsoft.com/v7/site/search.aspx?q=3167679" id="kb-link-16" target="_self">Microsoft Update Catalog</a> website.</div><div class="kb-collapsible kb-collapsible-expanded"> </div><h3 class="kb-collapsible kb-collapsible-expanded">Method 3: Microsoft Download Center</h3><div class="kb-collapsible kb-collapsible-expanded"><span>You can obtain the stand-alone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.<br/><br/>Click the download link in <a href="https://technet.microsoft.com/library/security/ms16-101" id="kb-link-17" target="_self">Microsoft Security Bulletin MS16-101</a> that corresponds to the version of Windows that you are running.</span></div></div><h2>More Information</h2><h3>How to obtain help and support for this security update</h3><p><span>Help for installing updates: <a href="https://support.microsoft.com/ph/6527" id="kb-link-18" target="_self">Support for Microsoft Update</a><br/><br/>Security solutions for IT professionals: <a href="https://technet.microsoft.com/security/bb980617.aspx" id="kb-link-19" target="_self">TechNet Security Troubleshooting and Support</a><br/><br/>Help for protecting your Windows-based computer from viruses and malware: <a href="https://support.microsoft.com/contactus/cu_sc_virsec_master" id="kb-link-20" target="_self">Virus Solution and Security Center</a><br/><br/>Local support according to your country: <a href="https://www.microsoft.com/en-us/locale.aspx" id="kb-link-21" target="_self">International Support</a></span></p><p><a class="bookmark" id="fileinfo"></a></p><h2>File Information</h2><div class="kb-references-section section"><div class="faq-section" faq-section=""><div class="faq-panel"><div class="faq-panel-heading" faq-panel-heading=""><span class="link-expand-image"><span class="faq-chevron win-icon win-icon-ChevronUpSmall"></span></span><span class="bold btn-link link-expand-text"><span class="bold btn-link">File hash information</span></span></div><div class="faq-panel-body" faq-panel-body=""><span><div class="kb-collapsible kb-collapsible-collapsed"><div class="table-responsive"><table class="sbody-table table"><tr class="sbody-tr"><th class="sbody-th">File name</th><th class="sbody-th">SHA1 hash</th><th class="sbody-th">SHA256 hash</th></tr><tr class="sbody-tr"><td class="sbody-td">Windows6.0-KB3167679-v2-ia64.msu</td><td class="sbody-td">F3E96631261EEC8CC532D17116185D82B8C5EC7F</td><td class="sbody-td">97FEB0CF0AEF4E098689FD05E86E94876C4051943983458F250E114107944DAE</td></tr><tr class="sbody-tr"><td class="sbody-td">Windows6.0-KB3167679-v2-x86.msu</td><td class="sbody-td">AF2B19E84D0E58C9EF4243F9BCEE6AF6642737F0</td><td class="sbody-td">2F97DD85E073A5A9A6F32C6CF7DA98F7CEB6F13BBBFF992E612FCD6DE828CE00</td></tr><tr class="sbody-tr"><td class="sbody-td">Windows6.0-KB3167679-v2-x64.msu</td><td class="sbody-td">17FAEE7E981AB717C566360F7B7FE173C201D4DB</td><td class="sbody-td">9B81F7193CE5D66B9609CA09A690F98AFC96B2A928783788BDBDBC58D41861D4</td></tr></table></div></div><br/></span></div></div></div><div class="faq-section" faq-section=""><div class="faq-panel"><div class="faq-panel-heading" faq-panel-heading=""><span class="link-expand-image"><span class="faq-chevron win-icon win-icon-ChevronUpSmall"></span></span><span class="bold btn-link link-expand-text"><span class="bold btn-link">File information</span></span></div><div class="faq-panel-body" faq-panel-body=""><span><div class="kb-collapsible kb-collapsible-collapsed"><span>The English (United States) version of this software update installs files that have the attributes that are listed in the following tables. </span><h4 class="sbody-h4">Windows Vista and Windows Server 2008 file information</h4><div class="kb-collapsible kb-collapsible-collapsed"><span class="text-base">Notes</span><ul class="sbody-free_list"><li>The files that apply to a specific product, milestone (RTM, SP<strong class="sbody-strong">n</strong>), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:<br/><div class="table-responsive"><table class="sbody-table table"><tr class="sbody-tr"><th class="sbody-th">Version </th><th class="sbody-th">Product </th><th class="sbody-th">Milestone </th><th class="sbody-th">Service branch </th></tr><tr class="sbody-tr"><td class="sbody-td">6.0.600 <span class="text-base">2.19</span><span class="sbody-italic">xxx</span></td><td class="sbody-td">Windows Vista or Windows Server 2008</td><td class="sbody-td">SP2</td><td class="sbody-td">GDR</td></tr><tr class="sbody-tr"><td class="sbody-td">6.0.600 <span class="text-base">2.23</span><span class="sbody-italic">xxx</span></td><td class="sbody-td">Windows Vista or Windows Server 2008</td><td class="sbody-td">SP2</td><td class="sbody-td">LDR </td></tr></table></div></li><li>GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes. </li><li>The MANIFEST files (.manifest) and MUM files (.mum) that are installed are not listed. </li></ul><h5 class="sbody-h5 text-subtitle">For all supported ia64-based versions</h5><div class="kb-collapsible kb-collapsible-collapsed"><div class="table-responsive"><table class="sbody-table table"><tr class="sbody-tr"><th class="sbody-th">File name</th><th class="sbody-th">File version</th><th class="sbody-th">File size</th><th class="sbody-th">Date</th><th class="sbody-th">Time</th><th class="sbody-th">Platform</th></tr><tr class="sbody-tr"><td class="sbody-td">Adsmsext.dll</td><td class="sbody-td">6.0.6002.19693</td><td class="sbody-td">218,624</td><td class="sbody-td">10-Sep-2016</td><td class="sbody-td">16:21</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Adsmsext.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">218,624</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:10</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Advapi32.dll</td><td class="sbody-td">6.0.6002.19598</td><td class="sbody-td">1,964,544</td><td class="sbody-td">06-Feb-2016</td><td class="sbody-td">01:39</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Advapi32.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">1,963,520</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:10</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Bcrypt.dll</td><td class="sbody-td">6.0.6002.19677</td><td class="sbody-td">583,680</td><td class="sbody-td">10-Aug-2016</td><td class="sbody-td">13:07</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Bcrypt.dll</td><td class="sbody-td">6.0.6002.24004</td><td class="sbody-td">584,192</td><td class="sbody-td">10-Aug-2016</td><td class="sbody-td">13:07</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Ksecdd.sys</td><td class="sbody-td">6.0.6002.19655</td><td class="sbody-td">1,030,376</td><td class="sbody-td">11-May-2016</td><td class="sbody-td">13:10</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsasrv.dll</td><td class="sbody-td">6.0.6002.19693</td><td class="sbody-td">3,263,488</td><td class="sbody-td">10-Sep-2016</td><td class="sbody-td">16:22</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsasrv.mof</td><td class="sbody-td">Not applicable</td><td class="sbody-td">13,780</td><td class="sbody-td">03-Apr-2009</td><td class="sbody-td">21:34</td><td class="sbody-td">Not applicable</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsass.exe</td><td class="sbody-td">6.0.6002.18541</td><td class="sbody-td">17,920</td><td class="sbody-td">16-Nov-2011</td><td class="sbody-td">14:10</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Secur32.dll</td><td class="sbody-td">6.0.6002.19623</td><td class="sbody-td">202,752</td><td class="sbody-td">18-Mar-2016</td><td class="sbody-td">16:34</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Ksecdd.sys</td><td class="sbody-td">6.0.6002.23970</td><td class="sbody-td">1,030,888</td><td class="sbody-td">11-May-2016</td><td class="sbody-td">13:08</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsasrv.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">3,268,096</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:11</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsasrv.mof</td><td class="sbody-td">Not applicable</td><td class="sbody-td">13,780</td><td class="sbody-td">07-Mar-2016</td><td class="sbody-td">23:37</td><td class="sbody-td">Not applicable</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsass.exe</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">17,920</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">14:28</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Secur32.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">202,752</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:12</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Ncrypt.dll</td><td class="sbody-td">6.0.6002.19678</td><td class="sbody-td">524,800</td><td class="sbody-td">10-Aug-2016</td><td class="sbody-td">16:08</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Ncrypt.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">524,800</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:11</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Rpcrt4.dll</td><td class="sbody-td">6.0.6002.19598</td><td class="sbody-td">3,298,816</td><td class="sbody-td">06-Feb-2016</td><td class="sbody-td">01:41</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Rpcrt4.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">3,289,088</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:12</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Wdigest.dll</td><td class="sbody-td">6.0.6002.19659</td><td class="sbody-td">482,816</td><td class="sbody-td">14-May-2016</td><td class="sbody-td">15:31</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Wdigest.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">483,328</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:12</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Msv1_0.dll</td><td class="sbody-td">6.0.6002.19431</td><td class="sbody-td">570,880</td><td class="sbody-td">27-Jun-2015</td><td class="sbody-td">15:22</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Msv1_0.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">570,368</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:11</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Schannel.dll</td><td class="sbody-td">6.0.6002.19678</td><td class="sbody-td">819,200</td><td class="sbody-td">10-Aug-2016</td><td class="sbody-td">16:09</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Schannel.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">821,248</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:12</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Mrxsmb10.sys</td><td class="sbody-td">6.0.6002.19431</td><td class="sbody-td">669,184</td><td class="sbody-td">27-Jun-2015</td><td class="sbody-td">14:19</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Mrxsmb10.sys</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">670,208</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">14:18</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Mrxsmb20.sys</td><td class="sbody-td">6.0.6002.19431</td><td class="sbody-td">270,336</td><td class="sbody-td">27-Jun-2015</td><td class="sbody-td">14:19</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Mrxsmb20.sys</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">272,384</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">14:17</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Mrxsmb.sys</td><td class="sbody-td">6.0.6002.19279</td><td class="sbody-td">323,072</td><td class="sbody-td">09-Jan-2015</td><td class="sbody-td">00:12</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Mrxsmb.sys</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">325,632</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">14:17</td><td class="sbody-td">IA-64</td></tr><tr class="sbody-tr"><td class="sbody-td">Bcrypt.dll</td><td class="sbody-td">6.0.6002.19677</td><td class="sbody-td">275,968</td><td class="sbody-td">10-Aug-2016</td><td class="sbody-td">13:14</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Bcrypt.dll</td><td class="sbody-td">6.0.6002.24004</td><td class="sbody-td">275,968</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">13:14</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsasrv.mof</td><td class="sbody-td">Not applicable</td><td class="sbody-td">13,780</td><td class="sbody-td">08-Mar-2016</td><td class="sbody-td">00:42</td><td class="sbody-td">Not applicable</td></tr><tr class="sbody-tr"><td class="sbody-td">Secur32.dll</td><td class="sbody-td">6.0.6002.19693</td><td class="sbody-td">77,312</td><td class="sbody-td">10-Sep-2016</td><td class="sbody-td">16:30</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsasrv.mof</td><td class="sbody-td">Not applicable</td><td class="sbody-td">13,780</td><td class="sbody-td">07-Mar-2016</td><td class="sbody-td">23:37</td><td class="sbody-td">Not applicable</td></tr><tr class="sbody-tr"><td class="sbody-td">Secur32.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">77,312</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:17</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Rpcrt4.dll</td><td class="sbody-td">6.0.6002.19598</td><td class="sbody-td">679,424</td><td class="sbody-td">06-Feb-2016</td><td class="sbody-td">02:12</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Rpcrt4.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">678,912</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:17</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Wdigest.dll</td><td class="sbody-td">6.0.6002.19659</td><td class="sbody-td">175,616</td><td class="sbody-td">14-May-2016</td><td class="sbody-td">15:41</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Wdigest.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">175,616</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:16</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Msv1_0.dll</td><td class="sbody-td">6.0.6002.19431</td><td class="sbody-td">218,112</td><td class="sbody-td">27-Jun-2015</td><td class="sbody-td">16:02</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Msv1_0.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">218,112</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:16</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Schannel.dll</td><td class="sbody-td">6.0.6002.19678</td><td class="sbody-td">284,160</td><td class="sbody-td">10-Aug-2016</td><td class="sbody-td">15:44</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Schannel.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">284,672</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:16</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Adsmsext.dll</td><td class="sbody-td">6.0.6002.19693</td><td class="sbody-td">75,264</td><td class="sbody-td">10-Sep-2016</td><td class="sbody-td">16:27</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Adsmsext.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">75,264</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:14</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Advapi32.dll</td><td class="sbody-td">6.0.6002.19598</td><td class="sbody-td">802,304</td><td class="sbody-td">06-Feb-2016</td><td class="sbody-td">02:11</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Advapi32.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">802,816</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:14</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Ncrypt.dll</td><td class="sbody-td">6.0.6002.19678</td><td class="sbody-td">206,336</td><td class="sbody-td">10-Aug-2016</td><td class="sbody-td">15:43</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Ncrypt.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">205,312</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:16</td><td class="sbody-td">x86</td></tr></table></div><h5 class="sbody-h5 text-subtitle">For all supported x86-based versions</h5><div class="kb-collapsible kb-collapsible-collapsed"><div class="table-responsive"><table class="sbody-table table"><tr class="sbody-tr"><th class="sbody-th">File name</th><th class="sbody-th">File version</th><th class="sbody-th">File size</th><th class="sbody-th">Date</th><th class="sbody-th">Time</th><th class="sbody-th">Platform</th></tr><tr class="sbody-tr"><td class="sbody-td">Adsmsext.dll</td><td class="sbody-td">6.0.6002.19693</td><td class="sbody-td">75,264</td><td class="sbody-td">10-Sep-2016</td><td class="sbody-td">16:27</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Adsmsext.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">75,264</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:14</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Advapi32.dll</td><td class="sbody-td">6.0.6002.19598</td><td class="sbody-td">802,304</td><td class="sbody-td">06-Feb-2016</td><td class="sbody-td">02:11</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Advapi32.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">802,816</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:14</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Bcrypt.dll</td><td class="sbody-td">6.0.6002.19677</td><td class="sbody-td">274,944</td><td class="sbody-td">10-Aug-2016</td><td class="sbody-td">13:13</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Bcrypt.dll</td><td class="sbody-td">6.0.6002.24004</td><td class="sbody-td">274,944</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">13:14</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Ksecdd.sys</td><td class="sbody-td">6.0.6002.19655</td><td class="sbody-td">440,552</td><td class="sbody-td">11-May-2016</td><td class="sbody-td">13:09</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsasrv.dll</td><td class="sbody-td">6.0.6002.19693</td><td class="sbody-td">1,261,056</td><td class="sbody-td">10-Sep-2016</td><td class="sbody-td">16:28</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsasrv.mof</td><td class="sbody-td">Not applicable</td><td class="sbody-td">13,780</td><td class="sbody-td">03-Apr-2009</td><td class="sbody-td">21:30</td><td class="sbody-td">Not applicable</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsass.exe</td><td class="sbody-td">6.0.6002.18541</td><td class="sbody-td">9,728</td><td class="sbody-td">16-Nov-2011</td><td class="sbody-td">14:12</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Secur32.dll</td><td class="sbody-td">6.0.6002.19623</td><td class="sbody-td">72,704</td><td class="sbody-td">18-Mar-2016</td><td class="sbody-td">17:10</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Ksecdd.sys</td><td class="sbody-td">6.0.6002.23970</td><td class="sbody-td">440,552</td><td class="sbody-td">11-May-2016</td><td class="sbody-td">13:07</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsasrv.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">1,263,616</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:16</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsasrv.mof</td><td class="sbody-td">Not applicable</td><td class="sbody-td">13,780</td><td class="sbody-td">07-Mar-2016</td><td class="sbody-td">23:37</td><td class="sbody-td">Not applicable</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsass.exe</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">9,728</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">14:23</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Secur32.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">72,704</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:16</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Ncrypt.dll</td><td class="sbody-td">6.0.6002.19678</td><td class="sbody-td">206,336</td><td class="sbody-td">10-Aug-2016</td><td class="sbody-td">15:43</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Ncrypt.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">205,312</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:16</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Rpcrt4.dll</td><td class="sbody-td">6.0.6002.19598</td><td class="sbody-td">783,872</td><td class="sbody-td">06-Feb-2016</td><td class="sbody-td">02:12</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Rpcrt4.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">783,872</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:16</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Wdigest.dll</td><td class="sbody-td">6.0.6002.19659</td><td class="sbody-td">175,616</td><td class="sbody-td">14-May-2016</td><td class="sbody-td">15:41</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Wdigest.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">175,616</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:16</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Msv1_0.dll</td><td class="sbody-td">6.0.6002.19431</td><td class="sbody-td">218,112</td><td class="sbody-td">27-Jun-2015</td><td class="sbody-td">16:02</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Msv1_0.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">218,112</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:16</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Schannel.dll</td><td class="sbody-td">6.0.6002.19678</td><td class="sbody-td">284,160</td><td class="sbody-td">10-Aug-2016</td><td class="sbody-td">15:44</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Schannel.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">284,672</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:16</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Mrxsmb10.sys</td><td class="sbody-td">6.0.6002.19431</td><td class="sbody-td">217,088</td><td class="sbody-td">27-Jun-2015</td><td class="sbody-td">14:21</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Mrxsmb10.sys</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">217,088</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">14:17</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Mrxsmb20.sys</td><td class="sbody-td">6.0.6002.19431</td><td class="sbody-td">81,408</td><td class="sbody-td">27-Jun-2015</td><td class="sbody-td">14:21</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Mrxsmb20.sys</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">82,432</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">14:17</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Mrxsmb.sys</td><td class="sbody-td">6.0.6002.19279</td><td class="sbody-td">107,008</td><td class="sbody-td">09-Jan-2015</td><td class="sbody-td">00:17</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Mrxsmb.sys</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">107,520</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">14:17</td><td class="sbody-td">x86</td></tr></table></div><h5 class="sbody-h5 text-subtitle">For all supported x64-based versions</h5><div class="kb-collapsible kb-collapsible-collapsed"><div class="table-responsive"><table class="sbody-table table"><tr class="sbody-tr"><th class="sbody-th">File name</th><th class="sbody-th">File version</th><th class="sbody-th">File size</th><th class="sbody-th">Date</th><th class="sbody-th">Time</th><th class="sbody-th">Platform</th></tr><tr class="sbody-tr"><td class="sbody-td">Adsmsext.dll</td><td class="sbody-td">6.0.6002.19693</td><td class="sbody-td">105,472</td><td class="sbody-td">10-Sep-2016</td><td class="sbody-td">16:44</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Adsmsext.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">105,472</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:33</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Advapi32.dll</td><td class="sbody-td">6.0.6002.19598</td><td class="sbody-td">1,067,008</td><td class="sbody-td">06-Feb-2016</td><td class="sbody-td">01:59</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Advapi32.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">1,067,520</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:33</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Bcrypt.dll</td><td class="sbody-td">6.0.6002.19677</td><td class="sbody-td">306,688</td><td class="sbody-td">10-Aug-2016</td><td class="sbody-td">13:07</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Bcrypt.dll</td><td class="sbody-td">6.0.6002.24004</td><td class="sbody-td">306,688</td><td class="sbody-td">10-Aug-2016</td><td class="sbody-td">13:08</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Ksecdd.sys</td><td class="sbody-td">6.0.6002.19655</td><td class="sbody-td">516,328</td><td class="sbody-td">11-May-2016</td><td class="sbody-td">13:10</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsasrv.dll</td><td class="sbody-td">6.0.6002.19693</td><td class="sbody-td">1,690,624</td><td class="sbody-td">10-Sep-2016</td><td class="sbody-td">16:45</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsasrv.mof</td><td class="sbody-td">Not applicable</td><td class="sbody-td">13,780</td><td class="sbody-td">03-Apr-2009</td><td class="sbody-td">21:33</td><td class="sbody-td">Not applicable</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsass.exe</td><td class="sbody-td">6.0.6002.18541</td><td class="sbody-td">11,264</td><td class="sbody-td">16-Nov-2011</td><td class="sbody-td">14:34</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Secur32.dll</td><td class="sbody-td">6.0.6002.19623</td><td class="sbody-td">94,720</td><td class="sbody-td">18-Mar-2016</td><td class="sbody-td">18:15</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Ksecdd.sys</td><td class="sbody-td">6.0.6002.23970</td><td class="sbody-td">517,352</td><td class="sbody-td">11-May-2016</td><td class="sbody-td">13:08</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsasrv.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">1,694,208</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:34</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsasrv.mof</td><td class="sbody-td">Not applicable</td><td class="sbody-td">13,780</td><td class="sbody-td">07-Mar-2016</td><td class="sbody-td">23:37</td><td class="sbody-td">Not applicable</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsass.exe</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">11,264</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">14:46</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Secur32.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">94,720</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:35</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Ncrypt.dll</td><td class="sbody-td">6.0.6002.19678</td><td class="sbody-td">258,048</td><td class="sbody-td">10-Aug-2016</td><td class="sbody-td">16:12</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Ncrypt.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">258,048</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:35</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Rpcrt4.dll</td><td class="sbody-td">6.0.6002.19598</td><td class="sbody-td">1,304,576</td><td class="sbody-td">06-Feb-2016</td><td class="sbody-td">02:01</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Rpcrt4.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">1,308,160</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:35</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Wdigest.dll</td><td class="sbody-td">6.0.6002.19659</td><td class="sbody-td">205,824</td><td class="sbody-td">14-May-2016</td><td class="sbody-td">15:54</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Wdigest.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">205,824</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:35</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Msv1_0.dll</td><td class="sbody-td">6.0.6002.19431</td><td class="sbody-td">269,824</td><td class="sbody-td">27-Jun-2015</td><td class="sbody-td">15:40</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Msv1_0.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">269,312</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:35</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Schannel.dll</td><td class="sbody-td">6.0.6002.19678</td><td class="sbody-td">353,280</td><td class="sbody-td">10-Aug-2016</td><td class="sbody-td">16:12</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Schannel.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">354,304</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:35</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Mrxsmb10.sys</td><td class="sbody-td">6.0.6002.19431</td><td class="sbody-td">278,016</td><td class="sbody-td">27-Jun-2015</td><td class="sbody-td">14:30</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Mrxsmb10.sys</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">278,528</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">14:37</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Mrxsmb20.sys</td><td class="sbody-td">6.0.6002.19431</td><td class="sbody-td">109,056</td><td class="sbody-td">27-Jun-2015</td><td class="sbody-td">14:30</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Mrxsmb20.sys</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">110,080</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">14:37</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Mrxsmb.sys</td><td class="sbody-td">6.0.6002.19279</td><td class="sbody-td">136,192</td><td class="sbody-td">09-Jan-2015</td><td class="sbody-td">00:28</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Mrxsmb.sys</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">137,216</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">14:37</td><td class="sbody-td">x64</td></tr><tr class="sbody-tr"><td class="sbody-td">Bcrypt.dll</td><td class="sbody-td">6.0.6002.19677</td><td class="sbody-td">275,968</td><td class="sbody-td">10-Aug-2016</td><td class="sbody-td">13:14</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Bcrypt.dll</td><td class="sbody-td">6.0.6002.24004</td><td class="sbody-td">275,968</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">13:14</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsasrv.mof</td><td class="sbody-td">Not applicable</td><td class="sbody-td">13,780</td><td class="sbody-td">08-Mar-2016</td><td class="sbody-td">00:42</td><td class="sbody-td">Not applicable</td></tr><tr class="sbody-tr"><td class="sbody-td">Secur32.dll</td><td class="sbody-td">6.0.6002.19693</td><td class="sbody-td">77,312</td><td class="sbody-td">10-Sep-2016</td><td class="sbody-td">16:30</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Lsasrv.mof</td><td class="sbody-td">Not applicable</td><td class="sbody-td">13,780</td><td class="sbody-td">07-Mar-2016</td><td class="sbody-td">23:37</td><td class="sbody-td">Not applicable</td></tr><tr class="sbody-tr"><td class="sbody-td">Secur32.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">77,312</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:17</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Rpcrt4.dll</td><td class="sbody-td">6.0.6002.19598</td><td class="sbody-td">679,424</td><td class="sbody-td">06-Feb-2016</td><td class="sbody-td">02:12</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Rpcrt4.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">678,912</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:17</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Wdigest.dll</td><td class="sbody-td">6.0.6002.19659</td><td class="sbody-td">175,616</td><td class="sbody-td">14-May-2016</td><td class="sbody-td">15:41</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Wdigest.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">175,616</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:16</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Msv1_0.dll</td><td class="sbody-td">6.0.6002.19431</td><td class="sbody-td">218,112</td><td class="sbody-td">27-Jun-2015</td><td class="sbody-td">16:02</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Msv1_0.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">218,112</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:16</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Schannel.dll</td><td class="sbody-td">6.0.6002.19678</td><td class="sbody-td">284,160</td><td class="sbody-td">10-Aug-2016</td><td class="sbody-td">15:44</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Schannel.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">284,672</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:16</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Adsmsext.dll</td><td class="sbody-td">6.0.6002.19693</td><td class="sbody-td">75,264</td><td class="sbody-td">10-Sep-2016</td><td class="sbody-td">16:27</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Adsmsext.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">75,264</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:14</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Advapi32.dll</td><td class="sbody-td">6.0.6002.19598</td><td class="sbody-td">802,304</td><td class="sbody-td">06-Feb-2016</td><td class="sbody-td">02:11</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Advapi32.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">802,816</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:14</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Ncrypt.dll</td><td class="sbody-td">6.0.6002.19678</td><td class="sbody-td">206,336</td><td class="sbody-td">10-Aug-2016</td><td class="sbody-td">15:43</td><td class="sbody-td">x86</td></tr><tr class="sbody-tr"><td class="sbody-td">Ncrypt.dll</td><td class="sbody-td">6.0.6002.24017</td><td class="sbody-td">205,312</td><td class="sbody-td">09-Sep-2016</td><td class="sbody-td">15:16</td><td class="sbody-td">x86</td></tr></table></div></div><br/></div></div></div></div></span></div></div></div></div></body></html>